Platform
Android
6,158 known vulnerabilities.
6,158 results · Feed
-
High 8.4
In nfa_t4tnfcee_store_rx_buf of nfa_nfcee_act.cc, there is a possible way to achieve code execution due to a missing pe…
-
High 8.4
In UsbDialogHelper of UsbDialogHelper.java, there is a possible UI confusion due to misleading or insufficient UI. This…
-
Medium 4.0
In getXmlFileNameForUser of LocaleManagerService.java, there is a possible permission bypass due to a confusable path t…
-
High 7.8
In multiple functions of MmiUtils.java, there is a possible risk of USSD/MMI code execution due to improper input valid…
-
High 8.4
In onActivityResult in multiple locations, there is a possible contact leak from protected profile due to a confused de…
-
Medium 6.2
In ShortcutInfo of ShortcutInfo.java, there is a possible way to crash the launcher via unauthorized shortcuts due to r…
-
High 8.4
In onResult of AccountManagerService.java, there is a possible untrusted/misleading UI issue due to a logic error in th…
-
High 8.4
In queryRemoteConnectionServices of ConnectionServiceWrapper.java, there is a possible permission bypass due to a confu…
-
Medium 4.0
In multiple functions of MediaCarouselController.kt, there is a possible way for media to show up after disablement due…
-
High 8.4
In multiple functions of SaveUi.java, there is a possible bypass of package installation requirements due to a logic er…
-
High 8.4
In onCreate of SettingsApplication.java, there is a possible cross-profile consent dialog label injection due to improp…
-
Medium 6.8
In onStrongAuthRequiredChanged of UsbService.java, there is a possible unauthenticated enabling of USB data due to a lo…
-
Medium 6.2
In multiple locations, there is a possible denial of service due to a missing permission check. This could lead to loca…
-
Medium 4.0
In multiple locations, there is a possible way to share files across profiles due to a logic error in the code. This co…
-
Medium 4.0
In getRingtone of RingtoneFactory.java, there is a possible unprivileged access risk due to a missing permission check.…
-
High 8.4
In writeGrantedUriPermissions of UriGrantsManagerService.java, there is a possible permission bypass due to improper in…
-
High 8.4
In shouldBlockDirectoryFromTree of ExternalStorageProvider.java, there is a possible way to access protected data due t…
-
High 8.4
In multiple locations, there is a possible method for a primary user to disable secure nfc on other full users due to i…
-
High 8.4
In multiple locations, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay …
-
High 8.4
In multiple locations, there is a possible way to trick a user into disclosing Autofill contents due to a tapjacking/ov…
-
Medium 5.3
Amlogic DroidLogic SubTitleService Out-of-Bounds Write via VobSub SET_CONTR
The VobSub subtitle decoder libsub_vob (part of the Amlogic DroidLogic SubTitleService), as shipped on Nexbox A95X (Amlogic S905X) TV boxes, contains an out-of-bounds write vulnerability in vob_fill_pixel() that allows remote attackers to corrupt stack memory…
-
Medium 5.3
Amlogic DroidLogic SubTitleService Infinite Loop via get_vob_spu()
The VobSub subtitle decoder libsub_vob (part of the Amlogic DroidLogic SubTitleService), as shipped on Nexbox A95X (Amlogic S905X) TV boxes, contains an infinite loop vulnerability in get_vob_spu() that allows unauthenticated network attackers or local users …
-
High 7.8
Amlogic pppoe_wrapper Command Injection via AF_UNIX Socket
The pppoe_wrapper vendor daemon from the Amlogic Android SDK, as shipped on Nexbox A95X (Amlogic S905/S905X) TV boxes, contains a command injection vulnerability that allows local attackers to execute arbitrary commands as root by sending crafted messages to …
-
Medium 4.3
Maxthon Browser for Android < 7.5.8.103 Fullscreen Address Bar Spoofing
Maxthon Browser for Android before 7.5.8.103 contains an address bar spoofing vulnerability that allows remote attackers to misrepresent a page's origin by exploiting the lack of a persistent fullscreen notification or trusted origin indicator when the Fullsc…
-
Critical 9.6
Adobe Connect | Improper Control of Generation of Code ('Code Injection') (CWE-94)
Adobe Connect is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. E…
-
Low 2.9
VLC for Android before 3.7.2 File Overwrite via Spoofed Mail Attachment Provider
VLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerability in FileUtils.getUri() that trusts content URIs based only on the com.fsck.k9.attachmentprovider or gmail-ls authority. A co-installed app without permissions can declare thes…
-
Medium 6.3
Uncontrolled Recursion on Nested JSON Allows Denial of Service in android-json
The org.json parser in com.vaadin.external.google:android-json recurses once per nesting level with no depth limit: JSONTokener.nextValue() calls readArray() and readObject(), which call nextValue() again. A deeply nested JSON document, around 20 KB of nested…
-
Medium 4.3
Sleipnir Browser < 3.9.0 Fullscreen Address Bar Spoofing
Fenrir Sleipnir Browser for Android before 3.9.0 contains a UI spoofing vulnerability that allows remote attackers to impersonate the browser's trusted address bar by entering fullscreen mode via the Fullscreen API without displaying a persistent notification…
-
Medium 6.2
TickTick Android 8.2.2.0 Path Traversal via ShareReceiveActivity
TickTick Android application (com.ticktick.task) 8.2.2.0 contains a path traversal vulnerability in its exported ShareReceiveActivity that allows a malicious local application to write files outside the intended attachment directory by supplying a crafted con…
-
Medium 4.3
"Handmade Marketplace App - Creema" provided by CREEMA LTD. contains an open redirect vulnerability. When accessing a s…
-
Medium 5.3
The smartphone application "Vehicle Inspection Certificate Viewer" contains a vulnerability in which sensitive informat…
-
Medium 5.4
"ゲオアプリ" provided by GEO CORPORATION is vulnerable to improper authorization in handler for a custom URL scheme. An atta…
-
Medium 4.3
"ゲオアプリ" provided by GEO CORPORATION contains an issue with cleartext storage of sensitive information, which may allow …
-
Medium 6.0
Improper certificate validation in Cato Client tunnel handshake
Improper certificate validation in the tunnel handshake in Cato Client allows a man-in-the-middle attacker to impersonate a Cato Point of Presence (PoP) server and intercept or modify tunnel traffic.
-
High 7.8
Windows Graphics Component Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.
-
Medium 6.5
Windows GDI Information Disclosure Vulnerability
Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information over a network.
-
Medium 5.5
Win32k Information Disclosure Vulnerability
Out-of-bounds read in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.
-
High 8.0
Microsoft Power Apps Remote Code Execution Vulnerability
Origin validation error in Microsoft Power Apps allows an authorized attacker to execute code over a network.
-
High 8.0
Microsoft Office Graphics Elevation of Privilege Vulnerability
Stack-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges over a network.
-
High 7.0
Windows Win32k Elevation of Privilege Vulnerability
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.